Assess the risk of third-party GitHub Actions

Examples: ,

Actions

Assess all the actions

actions-security-demo/script-injection/.github/workflows/actions/changelog

2/10

nvidia/nvrc/__builder_checkout_dir__/.github/actions/image

The NVRC project provides a Rust binary that implements a simple init system for microVMs.

7/10

sersoft-gmbh/setup-gh-cli-action

A GitHub action that installs or updates the gh CLI

5/10

Maintained action available

envoyproxy/toolshed/actions/docker/cache/prime

6/10

caffeelake/serenity/.github/actions/setup

The Serenity Operating System 🐞

6/10

step-security/github-create-release-action/__builder_checkout_dir__/.github/actions/privacy-check

Create a GitHub release from a Tag. Secure drop-in replacement for Roang-zero1/github-create-release-action.

10/10

vexxhost/chart-vendor/image

Tool for vendoring Helm charts into a Git repository

4/10

Maintained action available

mercurytechnologies/delete-cancelled-runs

Deletes cancelled runs for a given workflow

3/10

slsa-framework/source-actions/slsa_with_provenance

Source tool actions (fallback)

3/10

pytorch/multipy/test-infra/.github/actions/pull-docker-image

torch::deploy (multipy for non-torch uses) is a system that lets you get around the GIL problem by running multiple Python interpreters in a single C++ process.

0/10

pavelzw/pytest-action

:octocat: GitHub Action to run pytest with GitHub Job Summaries support :snake: :rocket:

5/10

yonasbsd/flox/.github/actions/fill

Developer environments you can take with you

2/10

yonasbsd/mask/.github/actions/attach-release-assets

🎭 A CLI task runner defined by a simple markdown file

2/10

rstackjs/rstack-ecosystem-ci/.github/actions/ecosystem_ci_per_commit

Rstack Ecosystem CI

5/10

Maintained action available

imjasonh/gke-auth

K8s cred helper and setup without gcloud

4/10

Maintained action available

ministryofjustice/laa-court-data-ui/.github/actions/delete-dev-release

"View court data" webapp for viewing data from HMCTS's "Common Platform"

8/10

dustin4444/docs-v2/.github/actions/fill

InfluxData Documentation that covers InfluxDB Cloud, InfluxDB OSS 2.x, InfluxDB OSS 1.x, InfluxDB Enterprise, Telegraf, Chronograf, Kapacitor, and Flux.

5/10

Maintained action available

chainguard-dev/actions/donotsubmit

A collection of reusable Github Actions workflows.

8/10

sonarsource/sonar-kotlin/.github/actions/image

SonarSource Static Analyzer for Kotlin Code Quality and Security

4/10

Maintained action available

step-security/setup-qemu-action/_next/static/chunks/21618-769ae870d42e6ba8.js

GitHub Action to install QEMU static binaries. Secure drop-in replacement for docker/setup-qemu-action.

9/10